setup

Wire this repository to a Veris environment, once; re-running skips what still holds. Two transports, one contract each:

• Container (default). The code is never modified and never told — veris-proxy reroutes its outbound HTTP(S) into a sandbox from outside the process. Leaves .veris/run.sh (the exact veris-proxy run invocation), .veris/setup.json, and Dockerfile.veris only when deriving an image took real work.
• Direct (--direct). For an application whose own configuration reads each service's base URL from the environment variable the platform names (its env_hint) — then pointing those variables at a sandbox IS the shipped code path, and no proxy or docker is involved. reference/direct.md carries the contract; step 2 gates entry. Leaves .veris/setup.json with "tier": "direct".